KeyStoreCommands
Use the Jython or Jacl scripting languages to configure keystores with wsadmin. A keystore is created by the application server during install and can contain cryptographic keys or certificates. The commands and parameters in the KeyStoreCommands group can be used to create, delete, and manage keystores.
The KeyStoreCommands includes the following commands:
- changeKeyStorePassword
- changeMultipleKeyStorePasswords
- createKeyStore
- createCMSKeyStore
- deleteKeyStore
- exchangeSigners
- getKeyStoreInfo
- listKeyFileAliases
- listKeyStores
- listKeyStoreTypes
- modifyKeyStore
changeKeyStorePassword
The changeKeyStorePassword command modifies the password of a keystore. The command automatically saves the new password to the configuration.
Required parameters
- -keyStoreName
- Name of the password to change. (String, required)
- -keyStorePassword
- Name of the password to change. (String, required)
- -newKeyStorePassword
- New password that to use to access the keystore. (String, required)
- -newKeyStorePasswordVerify
- New password to confirm the new keystore password. (String, required)
Optional parameters
- -scopeName
- Management scope of the keystore. (String, optional)
Examples
Batch mode example usage:
- Jacl...
$AdminTask changeKeyStorePassword {-keystoreName myKeystore -keyStorePassword WebAS -newKeyStorePassword newpwd -newKeyStorePasswordVerify newpwd}- Use Jython string:
AdminTask.changeKeyStorePassword('[-keystoreName myKeystore -keyStorePassword WebAS -newKeyStorePassword newpwd -newKeyStorePasswordVerify newpwd]')- Use Jython list:
AdminTask.changeKeyStorePassword(['-keystoreName', 'myKeystore', '-keyStorePassword', 'WebAS', '-newKeyStorePassword', 'newpwd', '-newKeyStorePasswordVerify', 'newpwd'])
Interactive mode example usage:
- Jacl...
$AdminTask changeKeyStorePassword {-interactive}- Jython...
AdminTask.changeKeyStorePassword('-interactive')
changeMultipleKeyStorePasswords
The changeMultipleKeyStorePasswords command updates the passwords for each keystores in the configuration that has a specific password. This is useful because when creating keystore files on the system, they will have WebAS as a password by default.
Required parameters
- -keyStorePassword
- Name of the password to change. (String, required)
- -newKeyStorePassword
- New password that you will use to access the keystore. (String, required)
- -newKeyStorePasswordVerify
- Confirms the new keystore password. (String, required)
Optional parametersNone.
Examples
Batch mode example usage:
- Jacl...
$AdminTask changeMultipleKeyStorePasswords {-keyStorePassword WebAS -newKeyStorePassword newpwd -newKeyStorePasswordVerify newpwd}- Use Jython string:
AdminTask.changeMultipleKeyStorePasswords('[-keyStorePassword WebAS -newKeyStorePassword newpwd -newKeyStorePasswordVerify newpwd]')- Use Jython list:
AdminTask.changeMultipleKeyStorePasswords(['-keyStorePassword', 'WebAS', '-newKeyStorePassword', 'newpwd', '-newKeyStorePasswordVerify', 'newpwd'])
Interactive mode example usage:
- Jacl...
$AdminTask changeMultipleKeyStorePasswords {-interactive}- Jython...
AdminTask.changeMultipleKeyStorePasswords('-interactive')
createKeyStore
The createKeyStore command creates the keystore settings in the configuration and the keystore database.
Required parameters
- -keyStoreName
- The name that uniquely identifies the keystore configuration object. (String, required)
- -keyStoreType
- The implementation of the keystore management. (String, required)
- -keyStoreLocation
- The location of the keystore. For file based, the location is the files system path to the keystore database. For hardware keystore, the location is the path to the token library. (String, required)
- -keyStorePassword
- The password that protects the keystore. (String, required)
- -keyStorePasswordVerify
- The password that protects the keystore. (String, required)
Optional parameters
- -keyStoreProvider
- The provider used to implement the keystore. (String, optional)
- -keyStoreIsFileBased
- Set the value of this parameter to true if the keystore is file based. Set the value of this parameter to false for hardware crypto keystores. (Boolean, optional)
- -keyStoreHostList
- A list of host names that indicate from where the keystore is remotely managed, separated by commas. (String, optional)
- -keyStoreInitAtStartup
- Set the value of this parameter to true if the keystore is initialized at startup. Otherwise, set the value of this parameter to false. (Boolean, optional)
- -keyStoreReadOnly
- Set the value of this parameter to true if we cannot write to the keystore. Otherwise, set the value of this parameter to false. (Boolean, optional)
- -keyStoreStashFile
- Set the value of this parameter to true to create stash files for CMS type keystore. Otherwise, set the value of this parameter to false. (Boolean, optional)
- -enableCryptoOperations
- Specifies if the keystore object will be used for hardware cryptographic operations or not. The default value is false. (Boolean, optional)
- -keyStoreDescription
- Specifies user defined text to describe the keystore of interest. (String, optional)
- -keyStoreUsage
- Specifies the keystore usage of interest. Specify SSLKeys, KeySetKeys, RootKeys, DeletedKeys, DefaultSigners, or RSATokenKeys. (String, optional)
- -scopeName
- The name that uniquely identifies the management scope... (cell):localhostNode01Cell. (String, optional)
- -controlRegionUser
- Control region user to create a writable keystore object for the control regions key ring. Specify this option for SAF key rings when SAF writable key rings is enabled. (String, optional)
- -servantRegionUser
- Servant region user to create a writable keystore object for the servant regions key ring. Specify this option for SAF key rings when SAF writable key rings is enabled. (String, optional)
Examples
Batch mode example usage:
- Jacl...
$AdminTask createKeyStore {-keyStoreName testKS -keyStoreType JCEKS -keyStoreLocation c:\temp\testKeyFile.p12 -keyStorePassword testpwd -keyStorePasswordVerify testpwd -keyStoreIsFileBased true -keyStoreInitAtStartup true -keyStoreReadOnly false}- Use Jython string:
AdminTask.createKeyStore('[-keyStoreName testKS -keyStoreType JCEKS -keyStoreLocation c:\temp\testKeyFile.p12 -keyStorePassword testpwd -keyStorePasswordVerify testpwd -keyStoreIsFileBased true -keyStoreInitAtStartup true -keyStoreReadOnly false]')- Use Jython list:
AdminTask.createKeyStore(['-keyStoreName', 'testKS', '-keyStoreLocation', '-keyStoreType', 'JCEKS', 'c:\temp\testKeyFile.p12', '-keyStorePassword', 'testpwd', '-keyStorePasswordVerify', 'testpwd', '-keyStoreIsFileBased', 'true', '-keyStoreInitAtStartup', 'true', '-keyStoreReadOnly', 'false'])
Interactive mode example usage:
createCMSKeyStore
The createCMSKeyStore command creates a CMS keystore database and the keystore settings in the configuration.
Required parameters
- -cmsKeyStoreURI
- The URI of the CMS keystore. (String, required)
- -pluginHostName
- The host name of the plug-in. (String, required)
Optional parametersNone.
Examples
Batch mode example usage:
- Jacl...
$AdminTask createCMSKeyStore {-cmsKeyStoreURI CMSKeystoreURI -pluginHostName myHostName}- Use Jython string:
AdminTask.createCMSKeyStore('-cmsKeyStoreURI CMSKeystoreURI -pluginHostName myHostName')- Use Jython list:
AdminTask.createCMSKeyStore(['-cmsKeyStoreURI', 'CMSKeystoreURI', '-pluginHostName', 'myHostName'])
Interactive mode example usage:
- Jacl...
$AdminTask createCMSKeyStore {-interactive}- Jython...
AdminTask.createCMSKeyStore('-interactive')
deleteKeyStore
The deleteKeyStore command deletes the settings of a keystore from the configuration and the keystore file.
Required parameters
- -keyStoreName
- The name that uniquely identifies the keystore to delete. (String, required)
Optional parameters
- -scopeName
- The name that uniquely identifies the management scope... (cell):localhostNode01Cell. (String, optional)
- -removeKeyStoreFile
- Specifies whether to remove the keystore file. Specify true to remove the keystore file or false to keep the keystore file in the configuration. (Boolean, optional)
Examples
Batch mode example usage:
- Jacl...
$AdminTask deleteKeyStore {-keyStoreName testKS}- Use Jython string:
AdminTask.deleteKeyStore('[-keyStoreName testKS]')- Use Jython list:
AdminTask.deleteKeyStore(['-keyStoreName', 'testKS'])
Interactive mode example usage:
exchangeSigners
The exchangeSigners command exchange signer certificate between keystores.
Required parameters
- -keyStoreName1
- The name that uniquely identifies a keystore. Specify a second keystore name using the keyStoreName2 parameter. (String, required)
- -keyStoreScope1
- The scope name of the keystore specified with the keyStoreName1 parameter. (String, required)
- -keyStoreName2
- The name that uniquely identifies a keystore. Specify a second keystore name using the keyStoreName1 parameter. (String, required)
- -keyStoreScope2
- The scope name of the keystore specified with the keyStoreName2 parameter. (String, required)
Optional parameters
- -certificateAlaisList1
- A list of aliases separated by a comma. (String, optional)
- -certificateAliasList2
- A list of aliases separated by a comma. (String, optional)
Examples
Batch mode example usage:
- Jacl...
$AdminTask exchangeSigners {-keyStoreName1 testKS -certificateAliasList1 testCert1 -keyStoreName2 secondKS -certificateAlaisList2 certAlis}- Use Jython string:
AdminTask.exchangeSigners('[-keyStoreName1 testKS -certificateAliasList1 testCert1 -keyStoreName2 secondKS -certificateAlaisList2 certAlis]')- Use Jython list:
AdminTask.exchangeSigners(['-keyStoreName1', 'testKS', '-certificateAliasList1', 'testCert1', '-keyStoreName2', 'secondKS', '-certificateAlaisList2', 'certAlis'])
Interactive mode example usage:
- Jacl...
$AdminTask exchangeSigners {-interactive}- Jython...
AdminTask.exchangeSigners('-interactive')
getKeyStoreInfo
The getKeyStoreInfo command displays the settings of a particular keystore.
Required parameters
- -name
- The name that uniquely identifies the keystore. (String, required)
Optional parameters
- -scopeName
- The name that uniquely identifies the management scope... (cell):localhostNode01Cell. (String, optional)
Examples
Batch mode example usage:
- Jacl...
$AdminTask getKeyStoreInfo {-name testKS}- Use Jython string:
AdminTask.getKeyStoreInfo('[-name testKS]')- Use Jython list:
AdminTask.getKeyStoreInfo(['-name', 'testKS'])
Interactive mode example usage:
- Jacl...
$AdminTask getKeyStoreInfo {-interactive}- Jython...
AdminTask.getKeyStoreInfo('-interactive')
listKeyFileAliases
The listKeyFileAliases command lists the certificates in a keystore file.
Required parameters
- -keyFilePath
- The path of the key file. (String, required)
- -keyFilePassword
- The password for the key file. (String, required)
- -keyFileType
- The key file type. (String, required)
Optional parametersNone.
Examples
Batch mode example usage:
- Jacl...
(Windows)
$AdminTask listKeyFileAliases {-keyFilePath c:\temp\testKeyFile.p12 -keyFilePassword testPwd -keyFileType PKCS12}
[HP-UX] [Solaris][AIX] [Linux]
$AdminTask listKeyFileAliases {-keyFilePath /temp/testKeyFile.p12 -keyFilePassword testPwd -keyFileType PKCS12}- Use Jython string:
(Windows)
AdminTask.listKeyFileAliases('[-keyFilePaht c:\temp\testKeyFile.p12 -keyFilePassword testPwd -keyFileType PKCS12]')
[HP-UX] [Solaris][AIX] [Linux]
AdminTask.listKeyFileAliases('[-keyFilePaht /temp/testKeyFile.p12 -keyFilePassword testPwd -keyFileType PKCS12]')- Use Jython list:
(Windows)
AdminTask.listKeyFileAliases(['-keyFilePaht', 'c:\temp\testKeyFile.p12', '-keyFilePassword', 'testPwd', '-keyFileType', 'PKCS12'])
[HP-UX] [Solaris][AIX] [Linux]
AdminTask.listKeyFileAliases(['-keyFilePaht', '/temp/testKeyFile.p12', '-keyFilePassword', 'testPwd', '-keyFileType', 'PKCS12'])
Interactive mode example usage:
- Jacl...
$AdminTask listKeyFileAliases {-interactive}- Jython...
AdminTask.listKeyFileAliases('-interactive')
listKeyStores
The listKeyStores command lists the keystore for a particular scope.
Required parameters
None.
Optional parameters
- -displayObjectName
- Specify the value of this parameter as true to list the keystore configuration objects within a scope. Set the value of this parameter to false to list the strings that contain the keystore name and management scope. (Boolean, optional)
- -scopeName
- Name that uniquely identifies the management scope, for example: (cell):localhostNode01Cell. (String, optional)
- -all
- Specify the value of this parameter as true to list all keystores. This parameter overrides the scopeName parameter. The default value is false. (Boolean, optional)
- -keyStoreUsage
- Specifies the keystore usage of interest. Specify SSLKeys, KeySetKeys, RootKeys, DeletedKeys, DefaultSigners, or RSATokenKeys. (String, optional)
Examples
Batch mode example usage:
Interactive mode example usage:
listKeyStoreTypes
The listKeyStoreTypes command lists all valid keystore types.
Required parameters: None.
Optional parametersNone.
Examples
Batch mode example usage:
Interactive mode example usage:
- Jacl...
$AdminTask listKeyStoreTypes {-interactive}- Use Jython string:
AdminTask.listKeyStoreTypes('-interactive')
modifyKeyStore
The modifyKeyStore command modifies attributes for an existing keystore. Only some keystore attributes are modifiable, depending on what we are modifying. Use the following guidelines to use the command:
- To use this command to change the keystore file that the keystore object references, specify the keyStoreName, keyStoreLocation, keyStoreType, and keyStorePassword parameters.
Required parameters
- -keyStoreName
- Unique name that identifies the keystore. (String, required)
Optional parameters
- -scopeName
- Management scope of the keystore. (String, optional)
- -keyStoreType
- Specifies one of the predefined keystore types. Valid values are JCEKS, CMSKS, PKCS12, PKCS11, and JKS. (String, optional)
- -keyStoreLocation
- Fully qualified location of the keystore file. To modify the location of the keystore file, specify the keyStoreLocation, keyStoreType, keyStorePassword, and keyStoreName parameters. (String, optional)
- -keyStorePassword
- Password to open the keystore. Use the changeKeystorePassword command to change the password of the keystore. (String, optional)
- -keyStoreIsFileBased
- Specifies whether the keystore is file based. To modify whether the keystore is file-based, specify the keyStoreIsFileBased and keyStoreName parameters. (Boolean, optional)
- -keyStoreInitAtStartup
- Specifies whether the keystore initiates at server startup. To modify whether the keystore initiates at server startup, specify the keyStoreInitAtStartup and keyStoreName parameters. (Boolean, optional)
- -keyStoreReadOnly
- Specifies whether the keystore is writable. To modify whether the keystore is read-only, specify the keyStoreReadOnly and keyStoreName parameters. (Boolean, optional)
- -keyStoreDescription
- Statement that describes the keystore. To modify the keystore description, specify the keyStoreDescription and keyStoreName parameters. (String, optional)
- -keyStoreUsage
- Specifies the keystore usage of interest. Specify SSLKeys, KeySetKeys, RootKeys, DeletedKeys, DefaultSigners, or RSATokenKeys. (String, optional)
Examples
Batch mode example usage:
- Jacl...
$AdminTask modifyKeyStore {-keyStoreName CellDefaultKeyStore -keyStoreLocation c:\temp\testKeyFile.p12 -keyStoreType JCEKS -keyStorePassword my1password}- Jython...
AdminTask.modifyKeyStore('-keyStoreName CellDefaultKeyStore -keyStoreLocation c:\temp\testKeyFile.p12 -keyStoreType JCEKS -keyStorePassword my1password')
Interactive mode example usage:
Related concepts
Key management for cryptographic uses
Related tasks
Use AdminTask for scripted administration
Automating SSL configurations using scripting
Create an SSL configuration at the node scope using scripting